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SuperLink RISK ASSESSMENT PROGRAM 

USER GUIDE 



The project to develop this product began in 1998 and was driven by several department 
needs or desires. First as we began moving to a central point of contact ("CPC") approach to 
supervision, it became more critical that each CPC be privy to current supervisory and risk 
information on all facets of a banking organization's operations, not just those related to safety 
and soundness. Second, the surveillance efforts in the non-safety and soundness sections of the 
department were limited and the results were not routinely communicated to the safety and 
soundness CPCs. Third, every section had its own ideas of how to create a "Watch List", and 
there was no uniformity of opinion on the criteria for placing an institution on or removing it from 
the Watch Lists. The direction management gave to the work group was to develop a 
comprehensive surveillance process that was structured to support the CPC approach. Although 
there was no initial thought of using SuperLink to accomplish the mission, it became clear early in 
the process that use of such a system afforded many administrative benefits. 

What is presented is the first iteration of the Moore Umbrella's (hereinafter, referred to as 
the department) revised surveillance process. For the most part, safety and soundness 
examiners will note little difference from what they are currently doing other than a slight increase 
in data input. Specialty area (CA, ISS, FASS, and CRM) examiners may find that there is 
additional work to do, but the degree of surprise will depend upon how much of the proposed new 
surveillance processes have been shared by the respective Banking Supervisors. 

In mid-1998, two separate safety and soundness surveillance policies / procedures were 
adopted, one for institutions larger than $1 billion ("LCBOs") and one for those less than $1 billion 
("Community"). Since their implementation, the work group has suggested relatively minor 
changes. In 1999, surveillance programs were proposed for CA, CRM, and the various 
components of FASS. Because of the Y2K initiative, department management agreed to defer 
the development and implementation of the ISS surveillance program until 2000. Implementation 
of the CA, CRM, and FASS surveillance programs is to begin in 1999. 

While each of the surveillance programs is unique to the needs of the specific section 
and is performed on a unique schedule, the guiding philosophy of the current initiative is that 
problems or issues in the specialty examination areas must be expressed in terms of the six risks 
(credit, market, operational, liquidity, legal, and reputational) utilized by safety and soundness 
examiners. This is the point where SuperLink comes into play. The expectation is that 
examiners, irrespective of section, will complete their surveillance activities and prepare their 
documents in accordance with the directions from their section's management. However, as you 
will observe as you read further, each section will need to express their concerns in terms of the 
type of risk it poses to the institution, the level of the risk, and the expected direction of the risk. 

The mechanics of the SuperLink system are such that the risks of each individual area 
flow up to the safety and soundness CPC in order that one individual can make an assessment of 
the risk profile for an entire organization. At the same time, managers of the specialty areas can 
continue to keep track of institutions that pose risks specific to that specialty area. Said another 
way; a safety and soundness CPC whose institution's Section 20 subsidiary is a problem; will 
need to decide to what degree the problems in the Section 20 elevate the risk to the overall 
institution. While the CPC may determine that the size of the Section 20 and the nature of its 
problems are not significant in the context of the overall organization, the manager of FASS still 
has the opportunity and responsibility to keep the Section 20 on the FASS radar. 

This two-tiered approach (CPC and Section) allow for the maintenance of two levels of 
what used to be called Watch Lists. However, given the difficulties noted above with the term 
"Watch List", that term will no longer be used. The current term is "High Risk Institutions" on both 



the composite rating basis and for the specific specialty areas. How institutions arrive on the 
High Risk Institutions Report ("HRI Report") is discussed further on in this document. 

One of the features of Lotus Notes that will be utilized in a future release of this program 
is the notification of individual examiners that a surveillance document for an institution they are 
responsible for is due to be completed (based upon the frequency established in the individual 
section surveillance programs) and the subsequent notification of the portfolio manager if it is not 
completed timely. Lotus Notes also aids in the review/approval process and allowing for any 
number of management reports. 



PROCEDURES TO COMPLETE A SuperLink RISK ASSESSMENT 



Overview of System 

The new Risk Assessment Database in SuperLink provides a comprehensive method for 
preparing, reviewing and reporting risk assessments. This process is to be used for all risk 
assessments prepared for surveillance regardless of section. The risk assessment should 
highlight both the strengths and vulnerabilities of an institution as well as providing a foundation 
for determining the supervisory activities to be conducted. Further, the assessment should apply 
to the entire spectrum of risks facing an institution. Therefore the entire SuperLink Risk 
Assessment program is driven by the following six risk factors as defined in SR 97-24(SUP): 

• Credit risk, which arises from the potential that a borrower or counterparty will fail to perform 
on an obligation. 

• Market risk, which is the risk to a financial institution's condition resulting from adverse 
movements in market rates or prices, such as interest rates, foreign exchange rates, or equity 
prices. 

• Liquidity risk, which is the potential that an institution will be unable to meet its obligations as 
they come due because of an inability to liquidate assets or obtain adequate funding (referred 
to as "funding liquidity risk") or that it cannot easily unwind or offset specific exposures 
without significantly lowering market prices because of inadequate market depth or market 
disruptions ("market liquidity risk"). 

• Operational risk, which arises from the potential that inadequate information systems, 
operational problems, breaches in internal controls, fraud, or unforeseen catastrophes will 
result in unexpected losses. 

• Legal risk, which arises from the potential that unenforceable contracts, lawsuits, or adverse 
judgements can disrupt or otherwise negatively affect the operations or condition of a banking 
organization. 

• Reputational risk, which is the potential that negative publicity regarding an institution's 
business practices, whether true or not, will cause a decline in the customer base, costly 
litigation, or revenue reductions. 

The SuperLink risk assessment matrix is used to identify significant activities, the type and level 
of inherent risk in these activities, and the adequacy of risk management over these activities as 
well as to determine composite risk assessments for each of these activities and the overall 
institution. 

Once the significant activities are identified, a composite risk "rating" of high, medium or low as 
well as a trend "rating" of increasing, decreasing, stable must be assigned. The composite risk 
rating assigned should be based on the following guidelines: 

• A high composite risk generally would be assigned to an activity where the risk 
management system does not significantly mitigate the high inherent risk of the activity. 
Thus, the activity could potentially result in a financial loss that would have a significant 
negative impact on the organization's overall condition, even in some cases where the 
systems are considered strong. For an activity with moderate inherent risk, a risk 
management system that has significant weaknesses could result in a high composite risk 
assessment because management appears to have an insufficient understanding of the risk 
and uncertain capacity to anticipate and respond to changing conditions. 

• A moderate composite risk generally would be assigned to an activity with moderate 
inherent risk where the risk management systems appropriately mitigate the risk. For an 
activity with a low inherent risk, significant weaknesses in the risk management system may 



result in a moderate composite risk assessment. On the other hand, a strong risk 
management system may reduce the risks of an inherently high-risk activity so that any 
potential financial loss from the activity would have only a moderate negative impact on the 
financial condition of the organization. 

A low composite risk generally would be assigned to an activity that has low inherent risks. 
An activity with moderate inherent risk may be assessed a low composite risk where internal 
controls and risk management systems are strong and effectively mitigate much of the risk. 



Risk Assessment 



The Risk Assessment database provides three types of views. The first (1 st ) view is the Risk 
Assessments. Within this view are the following six sub-views: 



Approved 
History 
Top Holder 
In Process* 

Portfolio Manager 
NED Entry 



this view will show each risk assessment that has been approved. 

this view will show a complete history of all risk assessments. 

this view will show bank holding companies and their subsidiaries 

this view will show each risk assessment that is in process but not 
yet approved by the supervisor. This is the actual "working" area of the 
Risk Assessments. Risk Assessments are added in this view. 

this view will show each risk assessment that is approved % for 
each institution assigned to a portfolio manager. 

this view will show NED forms for risk assessments that have been 
approved 
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* Agreement Corporation-Investment 
» Bank Holding Company 

► Data Processing Servicer 

* P$me s tic Entity Other 

► Federal Credit Union 

► Financial Holding Bank 

► Multi District Processing Center 

* Notional Bonks 

► Nondeposit Trust Co. Nonmember 
» Nonmembef Bonks 



* State Member Bonks 



V State Savings Bonks 



In Process - This is the actual "working" 
area of the Risk Assessments. Risk 
Assessments are added in this view. 



The second (2 nd ) view is the High Risk Institutions view. This view contains the Overall 
Risk Comments from the most recent SuperLink Risk Assessment, as well as summary 
and update comments from the Banking Supervisors. It is broken into the following 
three sub views. 



Institutions all institutions assigned a High Risk rating on at least one component on 
either the composite or sectional risk ratings. 

Composite all institutions assigned a High Risk rating on at least one component on 
the composite risk ratings and listed by the Supervisor of the institution. 

Sections specialty institutions assigned a High Risk rating on at least one 

component on the sectional risk ratings and listed by the particular area. 



The High Risk Institution view replaces the manual High-Risk Institutions process. When an 
institution has been assigned one or more High rating in any risk category in any risk 
assessment it is automatically placed on the High Risk Institutions Report (view). Functionality 
has been added to this process to allow the Portfolio Managers / Supervisors the ability to 
manually override a risk assessment in order to place an Institution on or take it off the High Risk 
Institutions Report. 

The third (3 rd ) view is the Watchlist view. The watchlist view contains comments from the 
Banking Supervisors. Unlike the High Risk Institutions view, the Watchlist view does not 
contain Overall Composite Risk comments from the SuperLink Risk Assessment. It is 

broken into the following three sub-views: 

Watchlist all institutions assigned a High Risk rating on at least one component on 
the most recent composite or section risk assessment, including 
summary comments from the Banking Supervisors. 

Watchlist by quarter 

all institutions on the watchlist sorted by date of the watchlist comments 
from the Banking Supervisors 

Watchlist History 

all institutions on the watchlist sorted by institution type. Shows current and past SuperLink Risk 
Assessments and the corresponding watchlist comments 



There are two types of risk assessments that can be prepared for each institution using this 
database. 



Sectional Risk 



Composite Risk 
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